CVE-2011-2206

Published: Jun 22, 2011Modified: Apr 29, 2026

5.5

Vector

AV:N/AC:L/Au:S/C:P/I:N/A:P

Exploitability: 8.0 / Impact: 4.9

Source: NVD

Description

XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference, a different vulnerability than CVE-2011-1757.

Affected (5)

Products: Brad Fitzpatrick: Djabberd

Brad Fitzpatrick

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Brad Fitzpatrick Djabberd	version ≤ 0.84
Brad Fitzpatrick Djabberd	Version 0.80
Brad Fitzpatrick Djabberd	Version 0.81
Brad Fitzpatrick Djabberd	Version 0.82
Brad Fitzpatrick Djabberd	Version 0.83

Related CWEs

References (10)

http://groups.google.com/group/djabberd/msg/80a462d5c28873d7?dmode=source&output=gplain

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2011/06/14/6

Source: secalert@redhat.com

Patch

http://www.openwall.com/lists/oss-security/2011/06/15/5

Source: secalert@redhat.com

Patch

https://github.com/djabberd/DJabberd/commit/b41d6dc247a175fe8e092d6ec2c460826fa62992

Source: secalert@redhat.com

Patch

https://raw.github.com/djabberd/DJabberd/master/CHANGES

Source: secalert@redhat.com

http://groups.google.com/group/djabberd/msg/80a462d5c28873d7?dmode=source&output=gplain

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2011/06/14/6

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.openwall.com/lists/oss-security/2011/06/15/5

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/djabberd/DJabberd/commit/b41d6dc247a175fe8e092d6ec2c460826fa62992

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://raw.github.com/djabberd/DJabberd/master/CHANGES

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.